<!DOCTYPE html
  PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
  "DTD/xhtml1-strict.dtd">
<html>
  <head>
    <title>volatility.plugins.malware.impscan.ImpScan : API documentation</title>
    <meta content="text/html;charset=utf-8" http-equiv="Content-Type" />
    <link href="apidocs.css" type="text/css" rel="stylesheet" />
    
    
  </head>
  <body>
    <h1 class="class">v.p.m.i.ImpScan(<a href="volatility.plugins.common.AbstractWindowsCommand.html">common.AbstractWindowsCommand</a>) : class documentation</h1>
    <p>
      <span id="part">Part of <a href="volatility.html">volatility</a>.<a href="volatility.plugins.html">plugins</a>.<a href="volatility.plugins.malware.html">malware</a>.<a href="volatility.plugins.malware.impscan.html">impscan</a></span>
      
      <a href="classIndex.html#volatility.plugins.malware.impscan.ImpScan">View In Hierarchy</a>
    </p>
    <div>
      
    </div>
    <div>Scan for calls to imported functions<table class="fieldTable"></table></div>

    
    
    <div id="splitTables">
      <table class="children sortable" id="id211">
  
  
<tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.impscan.ImpScan.html#__init__">__init__</a></td>
    <td><span>Constructor uses args as an initializer. It creates an instance of OptionParser, populates the options, and finally parses the command line. Options are stored in the self.opts attribute.</span></td>
  </tr><tr class="staticmethod">
    
    
    <td>Static Method</td>
    <td><a href="volatility.plugins.malware.impscan.ImpScan.html#enum_apis">enum_apis</a></td>
    <td><span>Enumerate all exported functions from kernel or process space.</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.impscan.ImpScan.html#call_scan">call_scan</a></td>
    <td><span>Disassemble a block of data and yield possible calls to imported functions. We're looking for instructions such as these:</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.impscan.ImpScan.html#calculate">calculate</a></td>
    <td><span>This function is responsible for performing all calculations</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.impscan.ImpScan.html#render_text">render_text</a></td>
    <td><span>Render as text</span></td>
  </tr><tr class="method">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.impscan.ImpScan.html#render_idc">render_idc</a></td>
    <td><span>Render as IDC</span></td>
  </tr><tr class="method private">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.impscan.ImpScan.html#_call_or_unc_jmp">_call_or_unc_jmp</a></td>
    <td><span>Determine if an instruction is a call or an unconditional jump</span></td>
  </tr><tr class="method private">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.impscan.ImpScan.html#_vicinity_scan">_vicinity_scan</a></td>
    <td><span class="undocumented">No summary</span></td>
  </tr><tr class="method private">
    
    
    <td>Method</td>
    <td><a href="volatility.plugins.malware.impscan.ImpScan.html#_original_import">_original_import</a></td>
    <td><span>Revert a forwarded import to the original module and function name.</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.plugins.common.AbstractWindowsCommand.html">AbstractWindowsCommand</a>:
        </p>
        <table class="children sortable" id="id212">
  
  
<tr class="basestaticmethod">
    
    
    <td>Static Method</td>
    <td><a href="volatility.plugins.common.AbstractWindowsCommand.html#is_valid_profile">is_valid_profile</a></td>
    <td><span class="undocumented">Undocumented</span></td>
  </tr>
  
</table>
      
        <p>
          Inherited from <a href="volatility.commands.Command.html">Command</a> (via <a href="volatility.plugins.common.AbstractWindowsCommand.html">AbstractWindowsCommand</a>):
        </p>
        <table class="children sortable" id="id213">
  
  
<tr class="basestaticmethod">
    
    
    <td>Static Method</td>
    <td><a href="volatility.commands.Command.html#register_options">register_options</a></td>
    <td><span>Registers options into a config object provided</span></td>
  </tr><tr class="baseclassmethod">
    
    
    <td>Class Method</td>
    <td><a href="volatility.commands.Command.html#help">help</a></td>
    <td><span>This function returns a string that will be displayed when a user lists available plugins.</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#execute">execute</a></td>
    <td><span>Executes the plugin command.</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#format_value">format_value</a></td>
    <td><span>Formats an individual field using the table formatting codes</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#table_header">table_header</a></td>
    <td><span>Table header renders the title row of a table</span></td>
  </tr><tr class="basemethod">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#table_row">table_row</a></td>
    <td><span>Outputs a single row of a table</span></td>
  </tr><tr class="basemethod private">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#_formatlookup">_formatlookup</a></td>
    <td><span>Code to turn profile specific values into format specifications</span></td>
  </tr><tr class="basemethod private">
    
    
    <td>Method</td>
    <td><a href="volatility.commands.Command.html#_elide">_elide</a></td>
    <td><span>Adds three dots in the middle of a string if it is longer than length</span></td>
  </tr>
  
</table>
      
      
    </div>
    
    
    

    <div class="function">
  <a name="volatility.plugins.malware.impscan.ImpScan.__init__">
    
  </a>
  <a name="__init__">
    
  </a>
  <div class="functionHeader">
    
    def
    __init__(self, config, *args, **kwargs):
    
  </div>
  <div class="functionBody">
    <div class="interfaceinfo">overrides <a href="volatility.commands.Command.html#__init__">volatility.commands.Command.__init__</a></div>
    <div>Constructor uses args as an initializer. It creates an instance
of OptionParser, populates the options, and finally parses the
command line. Options are stored in the self.opts attribute.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.impscan.ImpScan.enum_apis">
    
  </a>
  <a name="enum_apis">
    
  </a>
  <div class="functionHeader">
    @staticmethod<br />
    def
    enum_apis(all_mods):
    
  </div>
  <div class="functionBody">
    
    <div>Enumerate all exported functions from kernel
or process space.</p>
<p>&#64;param all_mods: list of _LDR_DATA_TABLE_ENTRY</p>
<p>To enum kernel APIs, all_mods is a list of drivers.
To enum process APIs, all_mods is a list of DLLs.</p>
<p>The function name is used if available, otherwise
we take the ordinal value.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.impscan.ImpScan._call_or_unc_jmp">
    
  </a>
  <a name="_call_or_unc_jmp">
    
  </a>
  <div class="functionHeader">
    
    def
    _call_or_unc_jmp(self, op):
    
  </div>
  <div class="functionBody">
    
    <div>Determine if an instruction is a call or an
unconditional jump</p>
<p>&#64;param op: a distorm3 Op object<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.impscan.ImpScan._vicinity_scan">
    
  </a>
  <a name="_vicinity_scan">
    
  </a>
  <div class="functionHeader">
    
    def
    _vicinity_scan(self, addr_space, calls_imported, apis, base_address, data_len, forward):
    
  </div>
  <div class="functionBody">
    
    <div>Scan forward from the lowest IAT entry found or
backward from the highest IAT entry found. We do this
because not every imported function will be called
from the code section and sometimes page(s) with the
calls are unavailable.</p>
<p>&#64;param addr_space: an AS
&#64;param calls_imported: dictionary of confirmed imports
&#64;param apis: dictionary of exported functions in the AS
&#64;param base_address: memory base address
&#64;param data_len: size in bytes to check from base_address
&#64;param forwared: the direction for the vicinity scan<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.impscan.ImpScan._original_import">
    
  </a>
  <a name="_original_import">
    
  </a>
  <div class="functionHeader">
    
    def
    _original_import(self, mod_name, func_name):
    
  </div>
  <div class="functionBody">
    
    <div>Revert a forwarded import to the original module
and function name.</p>
<p>&#64;param mod_name: current module name
&#64;param func_name: current function name<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.impscan.ImpScan.call_scan">
    
  </a>
  <a name="call_scan">
    
  </a>
  <div class="functionHeader">
    
    def
    call_scan(self, addr_space, base_address, data):
    
  </div>
  <div class="functionBody">
    
    <div>Disassemble a block of data and yield possible
calls to imported functions. We're looking for
instructions such as these:</p>
<p>x86:
CALL DWORD [0x1000400]
JMP  DWORD [0x1000400]</p>
<p>x64:
CALL QWORD [RIP+0x989d]</p>
<p>On x86, the 0x1000400 address is an entry in the
IAT or call table. It stores a DWORD which is the
location of the API function being called.</p>
<p>On x64, the 0x989d is a relative offset from the
current instruction (RIP).</p>
<p>&#64;param addr_space: an AS to scan with
&#64;param base_address: memory base address
&#64;param data: buffer of data found at base_address<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.impscan.ImpScan.calculate">
    
  </a>
  <a name="calculate">
    
  </a>
  <div class="functionHeader">
    
    def
    calculate(self):
    
  </div>
  <div class="functionBody">
    <div class="interfaceinfo">overrides <a href="volatility.commands.Command.html#calculate">volatility.commands.Command.calculate</a></div>
    <div>This function is responsible for performing all calculations</p>
<p>We should not have any output functions (e.g. print) in this
function at all.</p>
<p>If this function is expected to take a long time to return
some data, the function should return a generator.<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.impscan.ImpScan.render_text">
    
  </a>
  <a name="render_text">
    
  </a>
  <div class="functionHeader">
    
    def
    render_text(self, outfd, data):
    
  </div>
  <div class="functionBody">
    
    <div>Render as text<table class="fieldTable"></table></div>
  </div>
</div><div class="function">
  <a name="volatility.plugins.malware.impscan.ImpScan.render_idc">
    
  </a>
  <a name="render_idc">
    
  </a>
  <div class="functionHeader">
    
    def
    render_idc(self, outfd, data):
    
  </div>
  <div class="functionBody">
    
    <div>Render as IDC<table class="fieldTable"></table></div>
  </div>
</div>
    <address>
      <a href="index.html">API Documentation</a> for Volatility 2.2, generated by <a href="http://codespeak.net/~mwh/pydoctor/">pydoctor</a> at 2013-06-24 15:16:10.
    </address>
  </body>
</html>